shim-cli: See what your coding agent sends. Mask what you can.